如何將用戶/訪問級別添加到我當前的登錄腳本？

Question

我目前正在學習PHP和MySQL，我一直在從一個基本的（雖然舊的）登錄腳本教程 - 我遇到過各種折舊功能等，我試圖改進這個腳本。

我想爲我的腳本添加不同的訪問級別，例如管理員和用戶。我在'用戶'表中添加了一行'access'，用戶訪問權限爲'1'，管理員權限爲'9'。

經過一些初步研究，似乎我需要能夠將用戶訪問級別存儲在會話變量中 - 這是正確的方式嗎？如果是這樣，當用戶登錄時，我最初將如何檢索這些內容？

一旦訪問級別存儲在會話變量中，我將如何限制對頁面的訪問 - 也許使用頭部重定向？

這是當前代碼我的工作從functions.php的

function checkLogin() 
    { 
    /* Check if user has been remembered */ 
    if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookpass'])){ 
     $_SESSION['username'] = $_COOKIE['cookname']; 
     $_SESSION['password'] = $_COOKIE['cookpass']; 
    } 

    /* Username and password have been set */ 
    if(isset($_SESSION['username']) && isset($_SESSION['password'])) 
    { 
    /* Confirm that username and password are valid */ 
    if(confirmUser($_SESSION['username'], $_SESSION['password']) != 0) 
    { 
    /* Variables are incorrect, user not logged in */ 
     unset($_SESSION['username']); 
     unset($_SESSION['password']); 
     return false; 
    } 
     return true; 
    } 
    /* User not logged in */ 
    else 
    { 
     return false; 
    } 
    } 

而且從login.php中

if(isset($_POST['sublogin'])){ 
    /* Check that all fields were typed in */ 
    if(!$_POST['user'] || !$_POST['pass']){ 
     $errors .= "You didn't fill in a required field.<br/>\n"; 

    } 


else{ 

    /* Once all fields are entered - perform form validation */ 


    /* Checks that username is in database and password is correct */ 
    $md5pass = md5($_POST['pass']); 
    $result = confirmUser($_POST['user'], $md5pass); 

    /* Check error codes */ 
    if($result == 1){ 
     $user_errors .= "That username doesn't exist in our database.<br/>\n"; 
    } 
    else if($result == 2){ 
     $pass_errors .= "Incorrect password, please try again.<br/>\n"; 
    } 


    /* Username and password correct, register session variables */ 
    if (empty($errors) && empty($user_errors) && empty($pass_errors)){ 
     $_POST['user'] = mysql_real_escape_string($_POST['user']); 
     $_SESSION['username'] = $_POST['user']; 
     $_SESSION['password'] = $md5pass; 
     /* Quick self-redirect to avoid resending data on refresh */ 
     echo "<META HTTP-EQUIV='refresh' CONTENT='0;URL=index.php'>"; 
    } 



    /** 
    * This is the cool part: the user has requested that we remember that 
    * and one to hold his md5 encrypted password. We set them both to 
    * he's logged in, so we set two cookies. One to hold his username, 
    * expire in 100 days. Now, next time he comes to our site, we will 
    * log him in automatically. 
    */ 
    if(isset($_POST['remember'])){ 
     setcookie("cookname", $_SESSION['username'], time()+60*60*24*100, "/"); 
     setcookie("cookpass", $_SESSION['password'], time()+60*60*24*100, "/"); 
    } 

    //return; 
} 
} 

任何幫助將非常感激，因爲我一直停留在這幾天現在，謝謝。

Answer 1

因此，這個前提假設你正在檢查限制資源到PHP中的角色，而不是從數據庫中。這可以很容易地改變，但我想我會讓這個前一個簡單。

模式：

users 
------- 
id_user 
identity 
credential 
role 
... other fields 

帳戶創建

不要使用MD5，它很容易實現，而且容易克服。沙只是一個更安全的小工具，沒有額外的工作。

$email_or_username = "francis@yaconiello.com"; 
$password = "PinkEleph4nt"; // not my real password for anything 
$role = "admin"; 
$sql = sprintf("INSERT INTO users SET identity='%s', credential='%s', role='%s'", 
    mysql_real_escape_string($email_or_username), 
    mysql_real_escape_string(sha1($password)), 
    mysql_real_escape_string($role)); 

帳戶登錄

這縮短了，我扔在查詢，但不是很多數據庫的邏輯，應該爲它的需要，閱讀評論。

// VALIDATE THE EMAIL/USERNAME and PASSWORD 

if($is_valid == TRUE) 
{ 
    $sql = sprintf("SELECT id_user FROM users WHERE identity='%s' AND credential='%s' LIMIT 1", 
     mysql_real_escape_string($email_or_username), 
     mysql_real_escape_string(sha1($password))); 

    // FETCH ROW save into $row 

    if(!empty($row)) 
    { 
     // A user was fetched save it into the session 
     $_SESSION['id_user'] = $row['id_user']; 

     // SUCCESS 
    } 
    else 
    { 
     // FAILURE 
    } 
} 

檢查用戶的角色

<?php 
function fetch_role() 
{ 
    $role = "guest"; 
    if(isset($_SESSION['id_user'])) 
    { 
     // User exists 
     $sql = sprintf("SELECT * FROM users WHERE id_user='%s' LIMIT 1", 
      mysql_real_escape_string($_SESSION['id_user'])); 

     // RUN THE MYSQL QUERY TO FETCH THE USER, SAVE INTO $row 

     if(!empty($row)) 
     { 
      $role = $user_row['role']; 
     } 
    } 

    return $role; 
} 

... 

$role = fetch_role(); 
if($role == 'guest') 
{ 
    // SHOW GUEST CONTENT 
} 
elseif($role == 'member') 
{ 
    // SHOW OTHER CONTENT 
} 
elseif($role == 'admin') 
{ 
    // SHOW ADMIN CONTENT 
} 

Answer 2

爲用戶表中的不同類型的用戶分配不同的角色id。 有一個上下文表，它將存儲不同文件路徑的信息（最好是文件夾中所需層次結構的最上層）。 並且包含角色和不同文件路徑之間的映射（即哪種類型的用戶被允許訪問哪個路徑）的表格
現在在受限制文件的頂部，有一個util方法，它將接受__FILE__路徑和角色ID，並將告訴用戶是否有訪問權限，從而採取相關措施。所以你只需要在會話變量中存儲角色ID。